Description

Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell (e.g. /bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url <value>). If an attacker supplies a malicious gradle-wrapper.properties whose distributionUrl contains shell command substitution syntax such as $(...), the shell evaluates it before Gradle parses the URL, resulting in arbitrary command execution in the Renovate runtime. Exploitation requires the attacker to introduce the malicious file into a repository that Renovate scans; the issue occurs even when allowScripts is disabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.7",
  "pubDate": "2026-08-19T14:17:49.520Z",
  "pubdate": "2026-08-19T14:17:49.520Z",
  "executiveSummary": "A command injection vulnerability exists within Renovate versions >=32.124.0 and before 42.68.5, as well as Mend renovate-ce/renovate-ee before 13.3.0. The flaw resides in the Gradle Wrapper artifact handling functionality, specifically during the processing of wrapper updates.\nThe vulnerability allows an attacker capable of introducing a malicious file into a scanned repository to achieve arbitrary command execution within the Renovate runtime environment. This critical impact occurs regardless of whether allowScripts is enabled or disabled, presenting significant risk to the integrity and confidentiality of the host execution environment.\nExploitation requires the attacker to submit a modified gradle-wrapper.properties file containing malicious shell command substitution syntax. When Renovate attempts to process dependency updates, it improperly constructs shell commands using untrusted input from the configuration file, leading directly to operating system command execution under the privileges of the running Renovate process.",
  "technicalDetails": "The root cause of the vulnerability is unsafe command construction and execution during Gradle Wrapper artifact handling. When Renovate updates a Gradle Wrapper, it invokes a wrapper update command through a system shell, using an execution string comparable to /bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url <value>.\nThe vulnerable component is the Gradle Wrapper update handler within the Renovate runtime. The affected versions comprise Renovate versions from 32.124.0 up to, but not including, 42.68.5, alongside Mend renovate-ce/renovate-ee versions prior to 13.3.0.\nExploitation requires no authentication or special privileges within the Renovate application itself; however, the attacker must have the capability to introduce or modify files within a target repository that is subsequently scanned by Renovate. This is typically achieved via pull requests or direct commits in a shared repository environment.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious gradle-wrapper.properties file where the distributionUrl property incorporates shell command substitution syntax, such as the $() construct encapsulating arbitrary payload commands. Second, the target repository containing this crafted file is processed by a running instance of Renovate. Third, while analyzing or updating the dependency, Renovate extracts the malicious distributionUrl value and interpolates it directly into a shell invocation command string without prior sanitization or escaping. Fourth, the underlying shell (/bin/sh) evaluates the command substitution syntax and executes the injected shell commands before the Gradle parser ever processes the URL string. Finally, arbitrary code execution is achieved within the Renovate runtime environment, potentially exposing sensitive environment variables, API tokens, or allowing further lateral movement within the CI/CD infrastructure depending on container or host isolation boundaries."
}